Knowledge Management

Calculate Average for distinct field

splunknewbie420
New Member

I have following data in my splunk results

ReportID Timedelay time Label
123 5 10:00AM Label A
123 10 10:15AM Label A
456 7 10:00AM Label B
456 9 10:03AM LabelB

I am trying to get an average of timedelay per 5 minutes, but I only wanted to get the maximum value of timedelay for each report
so for example I wanted to get average of 10+9 in the above example. Could someone please help me with a query I can use. Appreciate any help and your time. Thanks

0 Karma

somesoni2
Revered Legend

Can you provide the search that is generating the above splunk results? Also, if you want an average of time delay per 5 min with max value of timedelay for each report, for period 10:00AM to 10:05AM, shouldn't you be averaging 5 (for A)+9 (for B)??

0 Karma

dcarmack_splunk
Splunk Employee
Splunk Employee

Give this a try

earliest=-5m@m index=<myindex> sourcetype=<mydata> | fields Timedelay Label | eventstats max(Timedelay) AS max_Timedelay by Label | stats avg(max_Timedelay) AS avg

if you want the same results over a large window of time, you can do this

earliest=-24h index=<myindex> sourcetype=<mydata> | fields Timedelay Label | bucket span=5m __time | eventstats max(Timedelay) AS max_Timedelay by Label _time | stats avg(max_Timedelay) AS avg by _time
0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...